I'm completely content with that deal. But the deal only works if the warranty is clear. Unless it's unmistakable to users that they have crossed the line, they will complain if you break them. A comment next to the member is not enough: IDEs will happily auto-complete the names of internal-only members.